Capture triggers for capturing network data

Abstract

The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system provides a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network. Next, the system provides a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on the security risk, wherein the additional time-series event data includes one or more event attributes.

Description

RELATED APPLICATION[0001]The subject matter of this application is related to the subject matter in a co-pending non-provisional application by inventor Michael Dickey, entitled “Distributed Processing of Network Data Using Remote Capture Agents,” having Ser. No. 14 / 253,713, and filing date 15 Apr. 2014.[0002]The subject matter of this application is related to the subject matter in a co-pending non-provisional application by inventors Vladimir A. Shcherbakov and Michael R. Dickey and filed on the same day as the instant application, entitled “Protocol-Based Capture of Network Data Using Remote Capture Agents,” having Ser. No. 14 / 528,898, and filed on 30 Oct. 2014.[0003]The subject matter of this application is also related to the subject matter in a co-pending non-provisional application by inventors Vladimir A. Shcherbakov, Michael R. Dickey, Cary Glen Noel, Kishore R. Ramasayam and Mignon Belongie and filed on the same day as the instant application, entitled “Streamlining Config...

AI Technical Summary

Benefits of technology

[0011]The disclosed embodiments provide a system that facilitates the processing of network data. During operation, the system provides a risk-identification mechanism for identifying a security risk from time-series event data generated from network packets captured by one or more remote capture agents distributed across a network. Next, the system provides a capture trigger for generating additional time-series event data from the network packets on the one or more remote capture agents based on the security risk, wherein the additional time-series event data includes one or more event attributes.

[0019]In some embodiments, the additional time-series event data includes an event attribute associated with a protocol that facilitates analysis of the security risk.

Problems solved by technology

However, customers are moving away from managing physical servers and data centers and toward public and private cloud computing environments that provide software, hardware, infrastructure, and / or platform resources as hosted services using computing, storage, and / or network devices at remote locations.

For these customers, it is either impossible, or at best extremely challenging, to deploy physical network capture devices and infrastructure in the cloud computing environments.

Images